Omron NS Series HMI Cross-Site Request Forgery
Priority LOW 28CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Why it matters now
EPSS 0.00592 48th percentileScored 2026-11-07
Fix Fixed NS15 (Omron): 8.68xNS12 (Omron): 8.68x+3 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OMRON Corporation | NS15 | 8.1xx to before 8.68x | 8.68x | Patch available | CNA |
| OMRON Corporation | NS12 | 8.1xx to before 8.68x | 8.68x | Patch available | CNA |
| OMRON Corporation | NS10 | 8.1xx to before 8.68x | 8.68x | Patch available | CNA |
| OMRON Corporation | NS8 | 8.1xx to before 8.68x | 8.68x | Patch available | CNA |
| OMRON Corporation | NS5 | 8.1xx to before 8.68x | 8.68x | Patch available | CNA |
- NS15 VendorOMRON Corporation Affected 8.1xx to before 8.68x Fixed in 8.68x Patch available CNA
- NS12 VendorOMRON Corporation Affected 8.1xx to before 8.68x Fixed in 8.68x Patch available CNA
- NS10 VendorOMRON Corporation Affected 8.1xx to before 8.68x Fixed in 8.68x Patch available CNA
- NS8 VendorOMRON Corporation Affected 8.1xx to before 8.68x Fixed in 8.68x Patch available CNA
- NS5 VendorOMRON Corporation Affected 8.1xx to before 8.68x Fixed in 8.68x Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:omron:ns_series_system_program_firmware:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | OMRON Corporation |
| cpe:2.3:o:omron:ns_series_system_program_firmware:8.68:*:*:*:*:*:*:* | 8.68 | Vulnerable | OMRON Corporation |
| cpe:2.3:h:omron:ns10_hmi_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OMRON Corporation |
| cpe:2.3:h:omron:ns12_hmi_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OMRON Corporation |
| cpe:2.3:h:omron:ns15_hmi_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OMRON Corporation |
| cpe:2.3:h:omron:ns5_hmi_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OMRON Corporation |
| cpe:2.3:h:omron:ns8_hmi_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OMRON Corporation |
- cpe:2.3:o:omron:ns_series_system_program_firmware:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·OMRON Corporation
- cpe:2.3:o:omron:ns_series_system_program_firmware:8.68:*:*:*:*:*:*:* Versions 8.68 Vulnerable ·OMRON Corporation
- cpe:2.3:h:omron:ns10_hmi_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OMRON Corporation
- cpe:2.3:h:omron:ns12_hmi_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OMRON Corporation
- cpe:2.3:h:omron:ns15_hmi_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OMRON Corporation
- cpe:2.3:h:omron:ns5_hmi_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OMRON Corporation
- cpe:2.3:h:omron:ns8_hmi_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OMRON Corporation
Remediation
- Fix · CNA NS15 (Omron) Fixed in 8.68x
- Fix · CNA NS12 (Omron) Fixed in 8.68x
- Fix · CNA NS10 (Omron) Fixed in 8.68x
- Fix · CNA NS8 (Omron) Fixed in 8.68x
- Fix · CNA NS5 (Omron) Fixed in 8.68x
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Omron NS10, NS12 and 3 more products 8.68x
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2014-01885 Omron NS Series HMI Improper Neutralization of Input During Web Page GenerationPriority LOW 22
Timeline
- 2026-10-02 Threatist record created from CVE-2014-2369
- 2026-10-03 Alias added: GHSA-q256-f2r8-r85r
References
More OMRON Corporation Ns10 Hmi Terminal vulnerabilities
- TI-2014-01885 Omron NS Series HMI Improper Neutralization of Input During Web Page Generation CVSS 2.0MEDIUM 4.0
Sources
- CVE-2014-2369 · CVE Program
- CVE-2014-2369 · NVD
- FIRST EPSS
- GHSA-q256-f2r8-r85r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences